Splunk Search

Minutes and seconds formating

gravi
Explorer

I have a field that sends time in Min&sec in the format 3m7s

I want it to be in the format 3.07

Tried using the below eval but the result is null.

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%M%S"),"%M.%S")

Could you please help?

Thanks

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval temp="7h13m17s, 4m6s" 
| makemv delim="," temp 
| mvexpand temp 
| rex field=temp "((?P<hour>\d+)h){0,1}(?P<minutes>\d+)m(?P<seconds>\d+)s" 
| eval minutes = if(isnotnull(hour),((hour*60)+minutes),minutes) 
| eval result = minutes.".".printf("%02d",seconds) |table temp, result
0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think | eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S") will work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

This eval expression is returning nothing even if the input is in MmSs format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%Mm%Ss"),"%M.%S")

But if the fields is in HhMmSs the below eval expression is returng results in H.M.S format

| eval ProcessingTime=strftime(strptime(DFLoadTime, "%HhMm%Ss"),"%H.%M.%S")
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Let's try using rex to handle the optional hours value.

| makeresults
| eval time="34m56s" 
| rex field=time "(?:(?<hr>\d+)h)?(?<min>\d+)m(?<sec>\d+)s"
| eval hr=coalesce(hr,0)
| eval ProcessingTime=hr.":".min.":".sec
| convert dur2sec(ProcessingTime) 
| eval TimeinMin=(ProcessingTime)/60 
| table time, ProcessingTime,TimeinMin
---
If this reply helps you, Karma would be appreciated.
0 Karma

gravi
Explorer

Thnaks for the reply. I just realized that we have few results in MmSs format and few in HhMmSs format. It works if I have either of them but not both. Do you know if there is any generic wayto satisfy both scenarios?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...